Segmented protection system and method

ABSTRACT

A segmented protection system and method. The invention comprises a plurality of Processing Modules arranged in series along a Protection Bus. A number of Protection Groups may be formed along the Protection Bus, with each Protection Group comprising at least one Protection Processing Module and at least one Working Processing Module. Upon failure of the Working Processing Module, the Protection Processing Module substitutes for the failed Working Processing Module.

RELATED APPLICATION

[0001] This application claims priority under 35 U.S.C. 517 119 toprovisional application No. 60/252,457, filed Nov. 22, 2000, theentirety of which is incorporated herein by reference.

BACKGROUND OF THE INVENTION

[0002] 1. Field of the Invention

[0003] This invention generally relates to protection systems, and moreparticularly to protection systems utilizing a Protection Bus tofacilitate backup protection for one or more working devices.

[0004] 2. Description of the Background Art

[0005] In a typical communications environment, a service provider mayoffer a number of services to its customers, such as DS1, DS3, 0C-N orEthernet services. In order to provide reliable service, serviceproviders normally employ protection systems that provide backupcapabilities in case of equipment failure. For example, a communicationsystem that includes a plurality of Working Processing Modules, i.e.,Modules used in a service capacity, may also include one or more backupModules that can be used to replace a failed Working Processing Moduleto maintain system reliability.

[0006] Typical protection systems offer 1:n protection, where oneProtection Processing Module serves as a backup for n Working ProcessingModules in a Protection Group. In such systems, it may be a difficulttask (for example) to reconfigure a protection system that provides 1:4protection to instead provide 1:6 protection in response to changes insystem demand, or (as another example), to provide a second 1:nProtection Group. Accordingly, there exists a need in the art forsystems and methods that facilitate the creation and configuration ofmultiple Protection Groups.

SUMMARY OF THE INVENTION

[0007] The present invention provides a segmented protection system andmethod. The invention comprises a plurality of Processing Modulesarranged in series along a Protection Bus. One or more Protection Groupsmay be formed along the Protection Bus, with each Protection Groupcomprising at least one Protection Processing Module and at least oneWorking Processing Module. In operation, upon failure of a WorkingProcessing Module, the Protection Processing Module assumes thefunctionality associated with the failed Working Processing Module viaconnectivity that may include the Protection Bus.

[0008] In some embodiments, a protection system of the inventioncomprises (1) a plurality of Processing Modules arranged in series,where the plurality of Processing Modules includes at least oneProtection Processing Module and at least two Working Processing Modulesincluding a protected Working Processing Module; (2) a signal pathcomprising (a) a Normal Path that is connected to the protected WorkingProcessing Module, and (b) a Failure Path that is connected to aProcessing Module that is logically adjacent to the protected WorkingProcessing Module; and (3) a Protection Bus for connecting theProtection Processing Module to the Processing Module logically adjacentto the protected Working Processing Module.

[0009] In some embodiments of the present invention, the Protection Buscomprises a plurality of Protection Bus Segments, each Protection BusSegment forming a connection between two adjacent Processing Modules. Insuch embodiments, for each of i=1 to n Working Processing Modules, theinvention comprises (1) an ith signal path comprising (a) an ith NormalPath that is connected to the ith Working Processing Module, and (b) anith Failure Path that is connected to a Processing Module that islogically adjacent to the ith Working Processing Module; where the firstWorking Processing Module is the Working Processing Module that isadjacent to the Protection Processing Module, and the nth WorkingProcessing Module is the Working Processing Module that is logically thefarthest Processing Module from the Protection Processing Module.

[0010] In embodiments of the invention, Processing Modules comprise oneor more switching devices that may be used to place a Working ProcessingModule into service and/or to place a Protection Processing Module intoservice. In some embodiments, such switching devices are disposed alonga Protection Bus between adjacent Protection Bus Segments, and thus canbe used to segment multiple Protection Groups along the Protection Bus.

[0011] In some embodiments, the present invention includes one or moreNetwork Control Processing Modules (“NCPMs”). NCPMs may comprise aDistributed Processor Array and may be used to control the creation andoperation of one or more Protection Groups.

[0012] Additional features and advantages of the invention are set forthin part in the description which follows, and are in part obvious fromthe description, or may be learned by practice of the invention. Thefeatures and advantages of the invention may also be realized andattained by means of the instrumentalities and combinations particularlyset out in the appended claims.

BRIEF DESCRIPTION OF THE DRAWINGS

[0013] The accompanying drawings, which are incorporated in andconstitute part of the specification, illustrate preferred embodimentsof the invention, and together with the description, serve to explainthe principles of the invention.

[0014] In the accompanying drawings:

[0015]FIG. 1 depicts a plurality of Processing Modules arranged inseries along a Protection Bus.

[0016]FIG. 2 depicts an embodiment of the present invention comprising aplurality of Processing Modules connected in series through a backplane.

[0017]FIG. 3 depicts an embodiment of a protection system of the presentinvention comprising a plurality of Working Processing Modules arrangedin series along a Protection Bus.

[0018]FIG. 4 depicts an embodiment of a protection system of the presentinvention utilizing a 1:4 protection scheme.

[0019]FIG. 5 depicts an NCPM that can be locally or remotely controlledin accordance with embodiments of the present invention.

[0020]FIG. 6 depicts an embodiment of a protection system of the presentinvention utilizing a 1:4 protection scheme, where one WorkingProcessing Module has failed.

[0021]FIG. 7 depicts a fail line and a Processing Module present line,such as may be used in embodiments of the present invention.

[0022]FIG. 8 depicts an embodiment of a protection system of the presentinvention utilizing a 1:4 protection scheme, where two WorkingProcessing Modules have failed.

[0023]FIG. 9 depicts an embodiment of a protection system of the presentinvention utilizing a 1:4 protection scheme, where three WorkingProcessing Modules have failed.

[0024]FIG. 10 depicts an embodiment of a protection system of theinvention in which three Protection Groups have been formed fromfourteen Processing Modules.

[0025]FIG. 11 depicts an embodiment of a protection system of thepresent invention in which two Protection Groups have been formed, andone Working Processing Module has failed in each Protection Group.

[0026] Definitions

[0027] Unless otherwise noted in the specification or in the claims, allof the terms used in the specification and in the claims will have themeanings normally ascribed to these terms by workers of ordinary skillin the art. Certain terms specifically comprise the meanings associatedwith them as follows:

[0028] Processing Module: A device that is capable of performing aprocessing function, such as routing, handling or processing data. Insome embodiments, a Processing Module is embodied as a printed circuitboard that may be plugged into a slot on a motherboard or backplane. AProcessing Module may be dedicated for providing a particular type ofservice, such as DS1, DS3, 0C-N or Ethernet service.

[0029] Protection Group: A group of Processing Modules arranged inseries that perform one or more functions, such as providing DS1 and/orDS3 service. A Protection Group comprises a Protection Processing Moduleand one or more Working Processing Modules, such that upon failure of aWorking Processing Module the Protection Processing Module substitutesfor the failed Working Processing Module.

[0030] Working Processing Module: A Processing Module within aProtection Group that may provide one or more services, such as DS1service.

[0031] Protection Processing Module: A Processing Module within aProtection Group that has been designated to provide backup service incase of failure in one or more of the Working Processing Modules.

[0032] Protected Working Processing Module: A Working Processing Modulethat is Protected by a Protection Processing Module, such that uponfailure of the protected Working Processing Module, the ProtectionProcessing Module substitutes for the protected Working ProcessingModule.

[0033] Protection Bus: A path that is capable of logically connecting aplurality of Processing Modules in series. In some embodiments where theWorking Processing Modules in the protection system provide service overa plurality of paths, the Protection Bus comprises a plurality of paths.

[0034] Protection Bus Segment: A path along the Protection Bus that canform a connection between two adjacent Processing Modules.

[0035] Normal Path: A path that is capable, either alone or inconjunction with other paths and/or devices, of providing a route usedby a Working Processing Module during a normal operation.

[0036] Failure Path: A path that is capable, either alone or inconjunction with other paths and/or devices, of providing a route usedby a Protection Processing Module during a failure mode of operation.

[0037] Series, in series: A method of interconnecting a plurality ofcomponents such that a signal travels sequentially through each of thecomponents along a specified path. For example, the Processing Modulesdepicted in FIG. 1 are all considered to be in series along the pathdefined by the Protection Bus 100. For purposes of this patentapplication, the components in FIG. 1 are considered to be in seriesregardless of the position of any switching components separating theProtection Bus Segments. In addition, for purposes of this patentapplication, a Protection Group including a terminal slot or terminalProcessing Module in a set of slots or Processing Modules is consideredto be “in series,” even though the terminal slot or terminal ProcessingModule may not be capable of being connected to its logically adjacentslot or Processing Module.

[0038] Terminal: The terminal slot or terminal Processing Module in aProtection Group is the slot or Processing Module having the highestnumber of slots or Processing Modules in the series of slots orProcessing Modules between it and the protection slot or ProtectionProcessing Module associated with the Protection Group. A terminal slotor terminal Processing Module may be connected to the Protection Bus,but in some embodiments, need not be connected to the Protection Bus.

[0039] Adjacent: Processing Modules that are directly coupled via aspecified path are considered to be adjacent. Non-adjacent ProcessingModules are either not coupled via a specified path, or are coupled viaa specified path only through an additional, intermediate ProcessingModule.

[0040] Logically adjacent: A Processing Module that is connected to afailure path associated with the signal path of another ProcessingModule is considered to be “logically adjacent” to the other ProcessingModule. In FIG. 1, IOB #3 is logically adjacent to IOB #4 and IOB #2 islogically adjacent to IOB #3. Typically, the logically adjacentProcessing Module precedes the specified Processing Module in a seriesthat originates at the Protection Processing Module. A Processing Modulethat is “logically adjacent” to another Processing Module need notnecessarily be adjacent to the other Processing Module, as the terms“adjacent” and “logically adjacent” are used in this application. Forexample, in a case where a terminal Processing Module that is a memberof a Protection Group is not capable of being connected to theProtection Bus, the Processing Module immediately preceding the terminalProcessing Module in the Protection Group series would be logicallyadjacent to the terminal Processing Module without being adjacent to theterminal Processing Module.

[0041] Logically the farthest Processing Module from the ProtectionProcessing Module: The Working Processing Module at the end of aProtection Group series that originates with the Protection ProcessingModule may be referred to as “logically the farthest Processing Modulefrom the Protection Processing Module” and may also be referred to asthe “terminal Processing Module.” As already noted, the terminalProcessing Module may be considered for purposes of this application tobe in series even though it is not actually connected to its logicallyadjacent Processing Module along the Protection Bus. In FIG. 1, IOB # 5is the Working Processing Module that is logically farthest from theProtection Processing Module. In FIG. 10, the IOBs occupying slots #5,#10, and #14 are the IOBs that are logically farthest within theirrespective Protection Groups.

[0042] Distributed Processor Array: One or more processors that arelogically or physically coupled, or both. For example, a singleprocessor is a Distributed Processor Array. Another example of aDistributed Processor Array is a plurality of processors that are inphysically different locations but are logically or physically coupled,or both.

[0043] Processor: A physical or virtual element whose operation iscontrolled by one or more computer programs. Processors comprise generalpurpose computer systems, special purpose computer systems, distributedcomputer systems, processor chips, discrete electronic circuits,processors that are simulated by software, and other computer processingdevices as are known in the art.

[0044] Network Control Processing Module (NCPM): A Processing Modulethat may be used to control the creation and operation of a ProtectionGroup. A NCPM may comprise a Distributed Processor Array.

[0045] Switching device: A device that selects, or may be used toselect, a path or circuit for sending a signal to its next destination.A switching device may, for example, be embodied as a mechanical switch,an optical switch, an electrical switch or another kind of switchingdevice as is known in the art.

DETAILED DESCRIPTION

[0046] Acts performed by systems, methods, apparatus elements, andapparatus functions of the present invention may be implemented, as isknown in the art, as software running on general purpose computers orspecial purpose computers, as hardware, or as combinations of softwareand hardware.

[0047]FIG. 1 depicts a plurality of Processing Modules 10 connected inseries. As depicted in FIG. 1, each Processing Module is connected toone or more adjacent Processing Modules 10 via a Protection Bus 100,including Protection Bus Segments 100 a, 100 b, 100 c, and 100 d. EachProcessing Module 10 may be configured to handle one or more services,for example, such as DS1, DS3, 0C-N or Ethernet traffic. The ProcessingModules may be part of a larger communications system, such as theOSX-6000 available from Ocular Networks, Sunset Corporate Plaza II,11109 Sunset Hills Road, Reston, Va. 20190.

[0048] In the embodiment of FIG. 1, Processing Modules 10 (#1-#5) areassociated with a number of signal paths (110, 120, 130, 140, and 150).Each signal path in FIG. 1 comprises a Normal Path (110 a, 120 a, 130 a,140 a, and 150 a). Signal paths 110, 120, 130, 140 comprise FailurePaths 110 b, 120 b, 130 b, and 140 b, respectively. The Normal Paths maybe used, for example, when Processing Modules 10 are functioning in anormal mode of operation. A Failure Path may be used, for example, toreplace a Working Processing Module with a Protection Processing Moduleduring a failure mode of operation. Processing Modules 10 are arrangedin series along Protection Bus 100, with a Protection Bus Segment (100a, 100 b , 100 c, and 100 d) connecting adjacent Processing Modules. Inthe embodiment shown in FIG. 1, Processing Module #1 can be designatedas the Protection Processing Module for the Protection Group comprisingProcessing Modules #1-#5. In some embodiments and for example, when theProtection System is enabled, Processing Module #1 serves as a backupfor any one of Processing Modules #2-5. If the failed Processing Moduleis Processing Module #5, Processing Module #1 provides the servicepreviously provided by Processing Module #5 through a path formed overProtection Bus 100, through Processing Modules #2-4, and over FailurePath 110 b. If the failed Processing Module is Processing Module #4,Processing Module #1 provides the service previously provided byProcessing Module #4 through a path formed over Protection Bus 100,through Processing Modules #2 and #3, and over Failure Path 120 b. Ifthe failed Processing Module is Processing Module #3, Processing Module#1 provides the service previously provided by Processing Module #3through a path formed over Protection Bus 100, through Processing Module2, and over Failure Path 130 b. Finally, if the failed Processing Moduleis Processing Module #2, Processing Module #1 provides the servicepreviously provided by Processing Module #2 over Failure Path 140 b.

[0049] As is apparent from FIG. 1, with appropriately configured wiring(as, for example, in a backplane, where the protection Modules areinput/output boards (IOBs) that can be inserted into slots in thebackplane), the Protection Group can easily be expanded to accommodateadditional Processing Modules, thereby changing the 1:4 Protection Groupof FIG. 1 to, for example, a 1:5, 1;6 or 1:20 Protection Group. In thecase of a 1:20 Protection Group, Processing Modules #6-#20 would beprotected in substantially the same manner as described above forProcessing Modules #2-4. A set of 20 Processing Modules arranged in thismanner can also be separated into a plurality of separate 1:n ProtectionGroups, each Protection Group having a Protection Processing Module andone or more Working Processing Modules. In some embodiments where thereare multiple Protection Groups, each Protection Group operatescompletely independently of any other Protection Group, for example, toprovide different services.

[0050] In an embodiment comprising a backplane with slots for twentyProcessing Modules, it is not strictly necessary that the terminal slotin the set of twenty slots actually be connected to the Protection Bus,as the Processing Module occupying that slot does not serve as alogically adjacent Processing Module to a failed Processing Module.While in such embodiments, the terminal slot is not strictly “in series”with the remainder of any Protection Group in which it may serve,Protection Groups comprising Working Processing Modules in such terminalslots function in substantially the same manner as Protection Groups notcomprising such Working Processing Modules. As discussed above, suchterminal slots are considered for purposes of this application to be inseries with the other slots in a Protection Group that includes theterminal slot.

[0051] In some embodiments, the Protection Bus can form a ring. Forexample, in some embodiments, a right-most slot that would otherwisehave naturally been a terminal slot (for example, because the wiring ofthe backplane determines that the Protection Processing Module willalways occupy the left-most position in a Protection Group) is connectednot only to its logically adjacent slot, but also to the left-most slotin the backplane via an extension of the protection bus and addition ofother wiring that would cause the right-most slot to be adjacent as wellas logically adjacent to the left-most slot. In such embodimentsinvolving twenty slots, for example, a Processing Module in slot 18might serve as the Protection Processing Module for a Protection Groupoccupying slots 18-20 and 1-3.

[0052]FIG. 2 shows a plurality of Processing Modules logically connectedin series through paths in a backplane 30. For ease of explanation, FIG.2 depicts a single path to represent what may be multiple paths. Thus, aProcessing Module may be connected to a large number of paths, in orderto enable the Processing Module to process signals from a large numberof sources. The Protection Bus may similarly comprise a large number ofseparate paths. In some embodiments involving Processing Modules servinga plurality of paths, switching between the paths may be controlled onan individualized basis, as discussed further with reference to FIG. 8,below. Furthermore, a given path (represented by a single line in FIG.2) may in fact comprise more than one wire for the additional reasonthat such a path may include (for example) separate wires for receiveand transmit signals, and grounding wires for each “transmission” wireand “receive” wire. Accordingly, the switching devices depicted in FIG.2 are depicted as switching signals rather than wire connections;switching a particular signal may comprise switching multiple wireconnections not depicted in FIG. 2.

[0053] The Processing Modules in FIG. 2 are embodied as Input/Outputboards (IOBs) 12. The IOBs 12 include a processing block 160 that maycomprise a Distributed Processor Array useful for performing dataprocessing functions. These processing functions may include decoding orprocessing data transmissions, and communicating with NCPM 70 regardingthe operation and state of the IOB. Each IOB 12 in FIG. 2 is associatedwith a signal path (110-150). Signal paths 110-140 each comprise aNormal Path and a Failure Path. For example, signal path 110 comprisesNormal Path 110 a that connects IOB #5 to external device 80, and alsocomprises Failure Path 110 b that connects IOB #4—the IOB that islogically adjacent to IOB #5—to external device 80. Were IOB #5 to fail,as will be described below, its Failure Path 110 b can be routed to aProtection Processing Module (e.g., IOB #1) along the Protection Bus 100through a path traversing IOBs #2, #3 and #4 (in cases where IOB #1 isdesignated as the Protection Processing Module).

[0054] Each IOB 12 in FIG. 2 comprises three switching devices 90. Thepresent invention may, however, work with a different number ofswitching devices than that shown in FIG. 2. Switching devices 90 may bemechanical or electrical relays, optical relays, solid state devices, orother devices capable of providing the functionality of a switch in asignal path. In the embodiments depicted in FIGS. 2, 4, 6, 8-9, and 11,the switching devices are depicted as switching between a pole marked“NC” and an unmarked pole. In some embodiments, (i) when a switchingdevice is not activated, the switching device forms a connection to the“NC” or “normally closed” pole and (ii) when a switching device isactivated, the switching device forms a connection to the unmarked pole.

[0055] In some embodiments, a protection system of the present inventionuses switching devices to connect the Failure Path entering a given IOBto a Protection Bus Segment connected to that IOB, in order to provide apath to connect the Protection Processing Module in failure operation.In the embodiment depicted in FIG. 2, switching devices 90 are labeledRLY #1, RLY #2 and RLY #3. In typical embodiments, each IOB 12 maycomprise multiple sets of these three switching devices, where each setof three switching devices corresponds to one port associated with theIOB. In the embodiment depicted in FIG. 2, each IOB 12 typicallycontrols its own switching devices (RLY #1, RLY #2, and RLY #3) underthe direction of NCPM 70. Although NCPM 70 is shown in FIG. 2 separatelyfrom backplane 30, in some embodiments NCPM 70 communicates with IOBs 12through wiring in backplane 30. In a typical embodiment involving abackplane having slots for accommodating IOBs, slots are provided forthe NCPMs alongside the slots provided for the IOBs. In someembodiments, the slots for the NCPMs and slots for the IOBs areconfigured differently to prevent an operator from mistakenly placing anNCPM in an IOB slot, or an IOB in an NCPM slot.

[0056] In FIG. 2, each IOB has a switching device link 92 (labeled asRLY #2 & 3 CTRL) to an adjacent IOB to the right. Switching device link92 may be used, for example, when the adjacent IOB cannot, on its own,control its switching devices #2 and #3. In some embodiments, switchingdevice link 92 comprises a “hard wire” between the IOBs. In someembodiments, switching device link 92 comprises a software connectionbetween the IOBs.

[0057] In some embodiments, NCPM 70 provides centralized intelligencefor controlling switching devices 90. For example and referring to FIG.2, NCPM 70 may include IOB links 94 to processor 160 on each IOB 12. IOBlinks 94 allow NCPM 70 to command each IOB to control its own switchingdevices or the switching devices of an adjacent IOB through a switchingdevice link 92. Switching device links 92 and IOB links 94 may be used,for example, to allow NCPM 70 to command an IOB to control the switchingdevices 90 of an adjacent IOB that is unable to control its ownswitching devices 90, such as in the case for example of an IOBprocessor 160 failure. In embodiments not employing NCPMs, a DistributedProcessor Array for providing overall control of the protection systemmay reside within one or more Processing Modules.

[0058] The Protection Bus 100 depicted in FIG. 2 is capable of logicallyconnecting each IOB to an adjacent IOB. Protection Bus 100 comprisesProtection Bus Segments 100 a, 100 b, l00 c and 100 d. As shown in FIG.2, segment 100 a is capable of logically connecting IOB #1 to IOB #2;segment 100 b is capable of logically connecting IOB #2 to IOB #3,segment 100 c is capable of logically connecting IOB #3 to IOB #4; andsegment 100 d is capable of logically connecting IOB #4 to IOB #5. Oneor more Protection Groups may be formed along the Protection Bus 100through, for example, operation of the switching devices 90.

[0059] In the embodiment of FIG. 2, the switching devices 90 aredepicted in the positions they would occupy upon start-up or universalor system reset. No Protection Processing Modules have been designatedin this embodiment; therefore, all Processing Modules can serve asWorking Processing Modules. In the depicted embodiment, no ProtectionGroups have been designated. As shown, switching devices 90 are all inthe NC position and Protection Bus 100 is isolated at each slot, becauseeach Protection Bus Segment (100 a-100 d) ends at an open circuit at RLY#3 of an adjacent IOB to the right. In other words, Protection Bus 100is segmented between IOBs 12. In addition, IOBs 12 are disconnected fromexternal device 80 at RLY #1.

[0060] Referring to FIG. 3, to begin service (i.e., a normal mode ofoperation), the #1 RLY on each IOB 12 is switched to connect its IOB 12to external device 80 via signal paths (110-150). As depicted in FIG. 3,the system has not yet created a Protection Group.

[0061]FIG. 4 depicts an embodiment of a single Protection Group (IOBs#1-#5), with the leftmost IOB (i.e., IOB #1) designated as a ProtectionProcessing Module. The designation of IOB #1 as the ProtectionProcessing Module may be accomplished, for example, by an operatorcommunicating with the system, either locally or remotely, through NCPM70, as depicted in FIG. 5. To designate IOB #1 as a ProtectionProcessing Module, in some embodiments NCPM 70 instructs IOB #1 toswitch its RLY #1 to the NC position to disconnect IOB #1 from externaldevice 80. With RLY #2 and RLY #3 of IOB #1 remaining in the NCposition, the processing block 160 of JOB #1 (the Protection ProcessingModule) is connected to the Protection Bus.

[0062] As noted, NCPM 70 may comprise local and/or remote controlcapabilities. For I example, as shown in FIG. 5, NCPM 70 may comprisecraft port 72 that allows an operator to connect with NCPM 70 throughlocal computer 74. In some embodiments, NCPM 70 comprises a networkmanagement port 76 that allows an operator to connect with a number ofnetwork devices, including NCPM 70, through remote computer 78. Ineither of these embodiments, the operator may, for example, control theprotection system by sending commands through NCPM 70.

[0063]FIG. 6 depicts the operation of embodiments of the protectionsystem depicted in FIG. 4 upon detection of failure of an IOB. Asdepicted in FIG. 6, IOB #3 has failed. In some embodiments, the systemdetects the failure of IOB #3 by means of a status line, such as a failline, associated with IOB #3, as known in the art. In some embodiments,a status line comprises a “hard wire” between an IOB and one or moreother IOBs. In some embodiments, a status line comprises a computer linkbetween an IOB and an NCPM or another IOB, or both.

[0064] Referring to FIG. 7, a fail line 170 may comprise a “hard wire”between IOB 12 and NCPM 70. During normal operation, IOB 12 maytransmit, for example, a particular signal state to NCPM 70, therebyindicating that the IOB 12 is functioning properly. In situations, forexample, where the processor fails, the signal state may change, therebyindicating to NCPM 70 that the processor is not functioning properly. Insome embodiments, the failure signal is initiated, and thus theprotection system is implemented, when the processor receives corruptedor unusable data. Other conditions, as are well known in the art, mayalso indicate an IOB failure and, therefore initiate a protection systemresponse.

[0065] In some embodiments, the protection system includes a “ProcessingModule present” line 175 that indicates to NCPM 70 whether a ProcessingModule is present in a particular Slot. The Processing Module presentline 175 may be associated with a status signal that indicates to NCPM70 that a Processing Module is present in a slot. If a Processing Moduleis not present in, or is removed from, the slot, then the status signalmay change, thereby indicating this condition to NCPM 70. In someembodiments, the Processing Module present line 175 is not associatedwith the functionality of the IOB or any processors within the IOB.Rather, in those embodiments, the Processing Module present line 175only indicates the presence or absence of a Processing Module. In someembodiments, the protection system responds to a removed ProcessingModule in a similar manner as it responds to a Processing Modulefailure.

[0066] Referring back to FIG. 6, IOB #3 may have been, for example,serving a number of customers over its associated Normal Path prior toits failure. The protection system depicted in FIG. 6 automaticallyreroutes those customers to the Protection Processing Module (IOB #1) asfollows:

[0067] 1 . The NCPM detects the failure of IOB #3 through a fail lineassociated with IOB #3. RLY #1 of IOB #3 goes to its NC position, eitheras a result of a command from the NCPM or as a result of a power failurewithin IOB #3, thereby disconnecting failed IOB #3 from external device80.

[0068] 2 . IOB #4 maintains its RLY #2 and RLY #3 in their NC positions,as does IOB #5 and as would any other downstream IOBs.

[0069] 3. The NCPM commands IOB #2 to switch its RLY #2 and RLY #3 awayfrom their NC positions, thereby connecting Protection Bus Segments 100a and 100 b to form a path along the Protection Bus 100 through IOB #2.This causes Failure Path 130 b for IOB #3 to be connected to theProtection Processing Module (IOB #1).

[0070] In the embodiment depicted in FIG. 6, once the ProtectionProcessing Module (IOB #1) has functionally replaced IOB #3 in thesystem, there is no further protection available for any remaining IOBswithin the Protection Group. After IOB #3 has been either repaired orreplaced, the system may be returned to its previous operating mode. Forexample, IOB #3 may be returned as a Working Processing Module and IOB#1 may again be available for failure protection.

[0071]FIG. 8 depicts an embodiment of the present invention in which twoIOBs within a single Protection Group have failed before thefirst-failed IOB can be repaired or replaced. In FIG. 8, IOB #4 failedfirst and IOB #3 failed second. In the embodiment of FIG. 8, the systemreacts to the failure of IOB #4 in a manner similar to that describedabove with reference to FIG. 6. Upon failure of IOB #3, customersassociated with IOB #3 will lose service, while customers associatedwith IOB #4 will continue to be served through the Protection ProcessingModule (IOB #1), as follows:

[0072] 1. Upon failure of IOB #4, the system operates as follows:

[0073] a. The fail line of IOB #4 indicates its failure to the NCPM. RLY#1 of IOB #4 goes to its NC position, thereby isolating failed IOB #4from its customers.

[0074] b. The NCPM commands IOB #3 to switch its RLY #2 and RLY #3 awayfrom their NC positions, thereby joining Protection Bus Segments 100 band 100 c to form a path along the Protection Bus 100 through IOB #3.

[0075] c. The NCPM commands IOB #2 to switch its RLY #2 to the NCposition and switch its RLY #3 away from the NC position, therebyjoining Protection Bus Segments 100 a and 100 b to form a path along theProtection Bus 100 through IOB #2. This causes Failure Path 120 b forIOB #4 to be connected to the Protection Processing Module IOB #1),which now is connected to serve customers previously served by failedIOB #4.

[0076] 2. Upon failure of IOB #3, the fail line associated with IOB #3activates. RLY #1 of IOB #3 goes to its NC position, thereby isolatingfailed IOB #3 from its customers. In some embodiments of the inventionwhere an IOB has multiple ports, each port on the IOB may be controlledon an individualized basis, thereby allowing operational ports on a IOBthat has experienced a partial failure to continue providing service.For example, rather than disconnecting every customer from IOB #3, onlythose customers that are connected to a failed port within IOB #3 may bedisconnected from IOB #3. The other RLY #1s (not depicted) on IOB #3are, if present, left switched away from the NC position if they remainfunctional, thereby providing continued service through the workingports of IOB #3.

[0077] 3. As a result of the failure of IOB #3, RLY #2 and RLY #3 of IOB#3 (which, in the embodiment depicted in FIG. 8, had been maintainedswitched away from their NC position by power received from IOB #3)switch to their NC position. The NCPM commands IOB #2 to take control ofRLY #2 and RLY #3 of IOB #3 and switch these switching devices back awayfrom their NC positions. In an embodiment, the NCPM also commands IOB #2to maintain its RLY #2 and RLY #3 in the positions they assumed in step1 above, thereby maintaining the connection between the Failure Path ofIOB #4 and the Protection Processing Module.

[0078] It should be noted that if the second “failure” in adouble-failure scenario is actually the removal from its slot of an IOBthat is logically between the first-failed IOB and the ProtectionProcessing Module, then the protection system will be unable to providecontinuous service to the application served by the first-failedProcessing Module. In some embodiments, in such cases the systemprovides the necessary switching to provide protection to theapplication served by the removed IOB. Thus, assuming that in the aboveexample IOB #3 was removed from its slot, then IOB #4's customers wouldlose service, and RLY #2 on IOB #2 would switch away from its NCposition to connect the Protection Bus to failure line 130 b to enablethe Protection Processing Module to substitute for IOB #3.

[0079]FIG. 9 depicts a situation in which three IOBs within a singleProtection Group have failed before any failed IOB has been replaced orrepaired. IOB #5 is the first to fail, followed by IOB #4 and then byIOB #3. The failure of IOB #3 may prevent it from controlling RLY #2 andRLY #3 on IOB #4. In such a case, customers on IOB #5 will lose service.IOB #2 is able to operate the switching devices of IOB #3, allowing foreither IOB #3 or IOB #4 to be protected through the ProtectionProcessing Module (e.g., IOB #1). FIG. 9 depicts, for example, thetransfer of prior protection for IOB #5 to IOB #3. This process is asfollows:

[0080] 1. The failure of IOBs #4 and #5 is handled similarly to theoperation described above regarding the double failure scenario in FIG.8. As such, prior to the failure of IOB #3, the service originallyprovided by IOB #5 (the first failed IOB) is provided by the ProtectionProcessing Module (IOB #1) and IOB #4 remains in a failed state.

[0081] 2. Upon failure of IOB #3, protection for failed IOB #5 cannot bemaintained, and Protection Processing Module (IOB #1) substitutes forIOB #3 in the following manner:

[0082] a. IOB #3 indicates its failure to the NCPM through its failline. RLY #1 of IOB #3 goes to its NC position, thereby isolating failedIOB #3 from its customers. RLY #2 and RLY #3 of IOB #3, which had beenswitched to positions away from the NC position in order to complete theProtection Bus through JOB #3 to enable IOB #1 to substitute for IOB #5,switch to their NC position, thereby disconnecting the Protection Bus atIOB #3.

[0083] b. NCPM commands IOB #2 to switch its RLY #2 and RLY #3 away fromthe NC position, thereby connecting Failure Path 130 b for IOB #3 to theProtection Processing Module (IOB #1).

[0084] As already mentioned, the wiring depicted in FIGS. 1, 2-4, 6, and8-9 can be replicated as many times as desired to accommodate additionalProcessing Modules to be placed along the Protection Bus after theright-most Processing Module depicted in those figures. According, a boxcomprising any number of slots (subject to physical constraints on thesize of the backplane) can be created in order to provide a protectionsystem as described above, with the capability of designating any set ofworking Module slots in series as a Protection Group. FIG. 10 thus showsan embodiment of the invention in which fourteen Processing Module slotshave been segmented into three Protection Groups and one unprotectedgroup. The manner in which these Protection Groups can be segmented willbe discussed in more detail below. Protection Group 1 comprises slots #1through #5, with slot #1 acting as the Protection Processing Module slotand slots #2 through #5 provided as Working Processing Module slots.

[0085] Protection Group 2 comprises slots #6, #7, and #10, with slot #6acting as the Protection Processing Module slot and slots #7 and #10provided as Working Processing Module slots. to Notably, slots #8 and #9comprise Network Control Processing Module (NCPM) slots, which are notpart of Protection Group 2. In some embodiments, these slots arededicated as NCPM slots and may not be used as Working Processing Moduleslots. Although the slots in Group 2 are not physically in series (i.e.,slots #7 and #10 are physically interrupted by slots #8 and #9), theymay nonetheless comprise a logical series through, for example, wiringin a backplane.

[0086] Protection Group 3 comprises slots #11 through #14, with slot #11acting as the Protection Processing Module slot and slots #12 through#14 being Working Processing Module slots. As depicted in FIG. 10, eachProtection Group comprises a Protection Processing Module slot and anumber of Working Processing Module slots. Slots #15 and #16 comprise anunprotected group that may accept unprotected Working ProcessingModules.

[0087] The decision regarding how to configure a Protection Group, howmany Protection Groups should exist and/or whether to leave a group ofProcessing Modules unprotected may rest on several factors, such as forexample, (i) the cost of the Protection Group, (ii) the criticality ofthe data transmission and (iii) the likelihood of equipment failure. Insome embodiments, including the embodiment shown in FIG. 10, theProtection Processing Module slot occupies the logical, left-mostposition within each Protection Group. This positioning of theProtection Processing Module slot is typically determined by wiring in abackplane. For example, in the embodiment depicted in FIG. 2, thebackplane is wired such that any Protection Processing Module wouldoccupy the left-most position in its Protection Group. A differentbackplane wiring configuration could be used, for example, as known inthe art, to require that the Protection Processing Module occupy thelogical right-most slot within its Protection Group.

[0088]FIG. 11 depicts an embodiment of the present invention comprisingtwo Protection Groups. In this embodiment, IOB #4 and IOB #5 form a 1:1Protection Group, and IOB #1 through IOB #3 form a 1:2 Protection Group.These Protection Groups may be configured by an NCPM under, for example,operator control. For example, an NCPM may separate the two ProtectionGroups by segmenting the Protection Bus via RLY #3 of IOB #4. In someembodiments, the system may employ additional switching devices (otherthan those shown in the drawings) to segment the Protection Bus, aswould be understood by those in the art. The ability to segment theProtection Bus allows embodiments of a protection system of the presentinvention to form multiple Protection Groups to accommodate varyingprotection needs, and to change the Protection Group configuration inresponse to further changes in those needs.

[0089] A failure in IOB #3 of the first Protection Group may cause someembodiments of the present invention to operate in a similar manner tothe failure protection described above with reference to FIG. 6. Afailure in IOB #5 in the second Protection Group may be handled asfollows. IOB #5 activates its fail line, thereby informing the NCPM ofits failure. RLY #1 of IOB #5 goes to its NC position, thereby isolatingfailed IOB #5 from its customers. NCPM commands the ProtectionProcessing Module (IOB #4) to switch its RLY #2 away from the NCposition, thereby connecting the Failure Path 110 b of failed IOB #5 tothe Protection Processing Module (IOB #4).

[0090] It should be understood that the preceding is merely a detaileddescription of some examples and embodiments of this invention and thatnumerous changes to the disclosed embodiments can be made in accordancewith the disclosure herein without departing from the spirit or scope ofthe invention. The preceding description, therefore, is not meant tolimit the scope of the invention.

I claim:
 1. A protection system comprising: (i) a plurality ofProcessing Modules arranged in series comprising at least one ProtectionProcessing Module and at least two Working Processing Modules includinga protected Working Processing Module; (ii) a signal path comprising aNormal Path that is connected to the protected Working ProcessingModule, and a Failure Path that is connected to a Processing Module thatis logically adjacent to the protected Working Processing Module; and(iii) a Protection Bus for connecting the Protection Processing Moduleto the Processing Module logically adjacent to the protected WorkingProcessing Module.
 2. The protection system of claim 1, wherein theProtection Bus comprises a plurality of Protection Bus Segments, eachProtection Bus Segment associated with at least one Working ProcessingModule.
 3. The protection system of claim 1, wherein, upon failure ofthe protected Working Processing Module, a connection is formed from theProtection Processing Module to the Failure Path.
 4. The protectionsystem of claim 3, wherein the protected Working Processing Module isnot adjacent to the Protection Processing Module.
 5. The protectionsystem of claim 2, further comprising, for each of i=1 to n WorkingProcessing Modules, an ith signal path comprising an ith Normal Paththat is connected to the ith Working Processing Module and an ithFailure Path that is connected to a Processing Module that is logicallyadjacent to the ith Working Processing Module, wherein the first WorkingProcessing Module is the Working Processing Module that is adjacent tothe Protection Processing Module, and the nth Working Processing Moduleis the Working Processing Module that is logically the farthestProcessing Module from the Protection Processing Module.
 6. Theprotection system of claim 5, wherein the Protection Bus comprises n-iProtection Bus Segments, and, for i=1, the ith Protection Bus Segmentconnects the ith Working Processing Module to the Protection ProcessingModule, and for i=2 to n-1, the ith Protection Bus Segment connects theith Working Processing Module to the (i-1)th Working Processing Module.7. The protection system of claim 6, wherein, for i=2 to n, upon failureof the ith Working Processing Module, a connection is formed from theProtection Processing Module to the ith Failure Path via the (i-1)thProtection Bus Segment.
 8. The protection system of claim 7, wherein theconnection formed from the Protection Processing Module to the ithFailure Path further comprises a switching device associated with the(i-1)th Working Processing Module.
 9. The protection system of claim 8,wherein the connection formed between the Protection Processing Moduleand the ith Failure Path comprises each Protection Bus Segment logicallybetween the ith Failure Path and the Protection Processing Module. 10.The protection system of claim 7, wherein, for i=1, upon failure of theith Working Processing Module a connection is formed from the ProtectionProcessing Module to the ith Failure Path, and the connection does notcomprise a Protection Bus Segment associated with a Working ProcessingModule.
 11. The protection system of claim 10, wherein the connectionformed between the Protection Processing Module and the ith Failure Pathcomprises a switching device associated with the Protection ProcessingModule.
 12. The protection system of claim 2, wherein the plurality ofProcessing Modules comprise at least one switching device for connectingthe at least one Protection Bus Segment associated with each of theplurality of Processing Modules to at least one other Protection BusSegment.
 13. The protection system of claim 12, wherein the at least oneswitching device comprises at least one electromechanical switchingdevice.
 14. The protection system of claim 12, wherein the at least oneswitching device comprises at least one optical switching device. 15.The protection system of claim 2, further comprising means forconfiguring the plurality of Processing Modules into a plurality ofProtection Groups, each Protection Group comprising at least one WorkingProcessing Module and at least one Protection Processing Module.
 16. Theprotection system of claim 15, wherein the configuring means comprises aNetwork Control Processing Module.
 17. The protection system of claim15, wherein the configuring means comprises at least one switchingdevice.
 18. The protection system of claim 15, wherein the plurality ofProcessing Modules are configured into a plurality of Protection Groups,each Protection Group comprising at least one Working Processing Moduleand at least one Protection Processing Module.
 19. The protection systemof claim 15, wherein the configuring means comprises a DistributedProcessor Array.
 20. The protection system of claim 19, wherein theDistributed Processor Array comprises at least one of the plurality ofProcessing Modules.
 21. The protection system of claim 2, wherein theplurality of Processing Modules are associated with a backplane.
 22. Theprotection system of claim 21, wherein the backplane comprises anelectronic circuit board.
 23. The protection system of claim 21, whereinthe backplane comprises a plurality of slots.
 24. The protection systemof claim 23, wherein at least one of the plurality of slots is speciallyadapted for use with a Network Control Processing Module.
 25. Theprotection system of claim 24, wherein the Network Control ProcessingModule comprises a Distributed Processor Array.
 26. The protectionsystem of claim 1, wherein at least one of the plurality of ProcessingModules comprises a Distributed Processor Array.
 27. A protection systemapparatus comprising: (i) a plurality of slots comprising a first slotand a second slot arranged in series, wherein the second slot islogically adjacent to the first slot; (ii) a signal path comprising aNormal Path that is connected to the first slot, and a Failure Path thatis connected to the second slot; and (iii) a Protection Bus comprisingat least one Protection Bus Segment for connecting two adjacent slots.28. The apparatus of claim 27, wherein the plurality of slots furthercomprise a third slot.
 29. The apparatus of claim 28, wherein the first,second and third slots are configured to accommodate Processing Modules,and wherein, upon failure of a Processing Module in the first slot, aconnection is formed through the Processing Module in the second slot toconnect the Failure Path connected to the second slot to a ProcessingModule in the third slot.
 30. The apparatus of claim 29, wherein thefirst slot is not logically adjacent to the third slot.
 31. A protectionsystem apparatus comprising n slots; and n-i signal paths, wherein foreach of I=1 to n-i signal paths, the ith signal path comprises an ithNormal Path that is connected to an ith slot, and an ith Failure Paththat is connected to a slot that is logically adjacent to the ith slot.32. The apparatus of claim 31, wherein the Protection Bus comprises n-2Protection Bus Segments, and, for each of i=1 to n-2 Protection BusSegments, the ith Protection Bus Segment connects the ith slot to a slotthat is logically adjacent to the ith slot.
 33. The apparatus of claim32, wherein, for i=2 to n-1, upon failure of a Working Module in the ithslot, a connection is formed from the slot that is logically adjacent tothe (i-1)th slot to the ith Failure Path via the (i-1)th Protection BusSegment.
 34. The apparatus of claim 33, wherein the connection formedfrom the slot that is logically adjacent to the (i-1)th slot to the ithFailure Path further comprises a switching device associated with aWorking Processing Module in the (i-1)th slot.
 35. A protection systemcomprising: (i) a plurality of Processing Modules arranged in seriescomprising at least one Protection Processing Module and at least twoWorking Processing Modules, wherein at least one Working ProcessingModule is a protected Working Processing Module, and at least oneWorking Processing Module is an adjacent Working Processing Module thatis logically adjacent to the protected Working Processing Module in thedirection of the Protection Processing Module; (ii) for each protectedWorking Processing Module, a signal path comprising a Normal Path thatis connected to the protected Working Processing Module, and a FailurePath that is connected to at least one adjacent Processing Module; and(iii) a Protection Bus for connecting the Protection Processing Moduleto the at least one adjacent Working Processing Module.
 36. Theprotection system of claim 35, wherein each of the Working ProcessingModules except for the terminal Working Processing Module is an adjacentWorking Processing Module.
 37. A protection system, comprising: aplurality of slots for accommodating a plurality of Processing Modules,each of the plurality of Processing Modules capable of performing aservice; a plurality of Protection Bus Segments, each Protection BusSegment capable of forming a connection between two adjacent slots;means for forming a Protection Group comprising a plurality ofProcessing Modules capable of being interconnected in series by aplurality of the plurality of Protection Bus Segments, where theplurality of Processing Modules is fewer than the plurality of slots;and means for designating a Protection Processing Module within theProtection Group, such that upon failure of a Processing Module in theProtection Group other than the Protection Processing Module, theProtection Processing Module becomes capable of performing the serviceprovided by the failed Processing Module.
 38. A protection systemmethod, comprising: (i) providing at least one Protection Groupcomprising a Protection Processing Module and at least one WorkingProcessing Module comprising a first Working Processing Module; (ii)providing a segmented Protection Bus operatively linking the ProtectionProcessing Module and the at least one Working Processing Module; and(iii) providing a signal path comprising a Normal Path that can beconnected to the first Working Processing Module and a Failure Path thatcan be connected to a Processing Module that is logically adjacent tothe first Working Processing Module, wherein upon failure of the firstWorking Processing Module, a connection is formed from the ProtectionProcessing Module to the Failure Path connected to the Processing Modulethat is logically adjacent to the first Working Processing Module.